Skip to content
  • Marc-André Lureau's avatar
    68066019
    char: fix use-after-free with dup chardev & reconnect · 68066019
    Marc-André Lureau authored
    
    
    With a reconnect socket, qemu_char_open() will start a background
    thread. It should keep a reference on the chardev.
    
    Fixes invalid read:
    READ of size 8 at 0x6040000ac858 thread T7
        #0 0x5555598d37b8 in unix_connect_saddr /home/elmarco/src/qq/util/qemu-sockets.c:954
        #1 0x5555598d4751 in socket_connect /home/elmarco/src/qq/util/qemu-sockets.c:1109
        #2 0x555559707c34 in qio_channel_socket_connect_sync /home/elmarco/src/qq/io/channel-socket.c:145
        #3 0x5555596adebb in tcp_chr_connect_client_task /home/elmarco/src/qq/chardev/char-socket.c:1104
        #4 0x555559723d55 in qio_task_thread_worker /home/elmarco/src/qq/io/task.c:123
        #5 0x5555598a6731 in qemu_thread_start /home/elmarco/src/qq/util/qemu-thread-posix.c:519
        #6 0x7ffff40d4431 in start_thread (/lib64/libpthread.so.0+0x9431)
        #7 0x7ffff40029d2 in __clone (/lib64/libc.so.6+0x1019d2)
    
    Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    Message-Id: <20200420112012.567284-1-marcandre.lureau@redhat.com>
    68066019
    char: fix use-after-free with dup chardev & reconnect
    Marc-André Lureau authored
    
    
    With a reconnect socket, qemu_char_open() will start a background
    thread. It should keep a reference on the chardev.
    
    Fixes invalid read:
    READ of size 8 at 0x6040000ac858 thread T7
        #0 0x5555598d37b8 in unix_connect_saddr /home/elmarco/src/qq/util/qemu-sockets.c:954
        #1 0x5555598d4751 in socket_connect /home/elmarco/src/qq/util/qemu-sockets.c:1109
        #2 0x555559707c34 in qio_channel_socket_connect_sync /home/elmarco/src/qq/io/channel-socket.c:145
        #3 0x5555596adebb in tcp_chr_connect_client_task /home/elmarco/src/qq/chardev/char-socket.c:1104
        #4 0x555559723d55 in qio_task_thread_worker /home/elmarco/src/qq/io/task.c:123
        #5 0x5555598a6731 in qemu_thread_start /home/elmarco/src/qq/util/qemu-thread-posix.c:519
        #6 0x7ffff40d4431 in start_thread (/lib64/libpthread.so.0+0x9431)
        #7 0x7ffff40029d2 in __clone (/lib64/libc.so.6+0x1019d2)
    
    Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    Message-Id: <20200420112012.567284-1-marcandre.lureau@redhat.com>
Loading